A method for associating a password with a secured public/private key pair is disclosed. A user public/private key pair is first established for a user. The user public/private key pair includes a user public key and a user private key. Then, the user public/private key pair is encrypted along with a random password, utilizing a chip public key. Next, a first password is generated by hashing a pass phrase. Finally, the random password is encrypted along with the first password, also utilizing the chip public key. As a result, a user can assess the user private key to perform an authentication function by providing the pass phrase.
|
1. A method for associating a password with a secured user public/private key pair within a computer system, said method comprising:
establishing a user public/private key pair for a user, wherein said user public/private key pair includes a user public key and a user private key; encrypting said user private key along with a random password; generating a first password by hashing a first pass phrase; encrypting said random password along with said first password; and utilizing said first pass phrase to access said user private key for performing an authentication function; generating a second password by hashing a second pass phrase; encrypting said random password along with said second password; and providing said second pass phrase to access said user private key for performing an authentication function.
6. A computer system having a password associated with a secured user public/private key pair, said computer system comprising:
means for establishing a user public/private key pair for a user, wherein said user public/private key pair includes a user public key and a user private key; means for encrypting said user private key along with a random password; means for generating a first password by hashing a first pass phrase; means for encrypting said random password along with said first password; and means for utilizing said first pass phrase to access said user private key for performing an authentication function; means for generating a second password by hashing a second pass phrase; means for encryption said random password along with said second password; and means for providing said second pass phrase to access said user private key for performing an authentication function.
11. A computer program product for associating a password with a secured user public/private key pair within a computer system, said computer program product comprising:
program code means for establishing a user public/private key pair for a user, wherein said user public/private key pair includes a user public key and a user private key; program code means for encrypting said user private key along with a random password; program code means for generating a first password by hashing a first pass phrase; program code means for encrypting said random password along with said first password; and program code means for utilizing said first pass phrase to access said user private key for performing an authentication function; program code means for generating a second password by hashing a second pass phrase; program code means for encrypting said random password along with said second password; and program code means for providing said second pass phrase to access said user private key for performing an authentication function.
2. The method according to
3. The method according to
4. The method according to
5. The method according to
7. The computer system according to
8. The computer system according to
9. The computer system according to
10. The computer system according to
12. The computer program product according to
13. The computer program product according to
14. The computer program product according to
15. The computer program product according to
|
The present invention is related to the subject matter of a United States Patent Application entitled "DATA PROCESSING SYSTEM AND METHOD FOR MAINTAINING SECURE USER PRIVATE KEYS IN NON-SECURE STORAGE," filed on Mar. 3, 1999, Ser. No. 09/262,123 now abandoned.
1. Technical Field
The present invention relates to a method and system for data processing in general, and in particular to a method and system for providing data security. Still more particularly, the present invention relates to a method for associating a password with a secured public/private key pair.
2. Description of the Prior Art
Cryptography involves a method for encrypting data in order to provide protection and security for the data. For example, before the transmission of a message from one party to another, the message can be encrypted using a mathematical function known as a cryptographic algorithm. The most common cryptographic algorithms are key-based, where special knowledge of variable information called a "key" is required to decrypt an encrypted message. There are two prevalent types of key-based cryptographic algorithms, namely, symmetric key (or secret key) algorithms and public key (asymmetric key) algorithms. The security provided by these cryptographic algorithms is centered around the keys and not the details of the cryptographic algorithms. In other words, the cryptographic algorithms can typically be known to all, but the keys can only be known by intended parties. As a result, it is possible to publish the cryptographic algorithm for public scrutiny, and then mass produce the cryptographic algorithm for incorporation into security products.
In most symmetric key algorithms, such as Data Encryption Standard (DES), the encryption key and the decryption key are the same. This single key encryption arrangement is not flaw-free because the sender and recipient of a message must somehow exchange information regarding the secret key. Each side must trust the other not to disclose the key. Furthermore, the sender must generally communicate the key via another relatively secure communication path (similar to a bank sending the personal identification number for an ATM card through the mail). This arrangement is not practical when, for example, the parties interact electronically for the first time over a computer network.
With public key algorithms, by comparison, the key used for encryption is different from the key used for decryption. It is generally very difficult to calculate the decryption key from an encryption key. In a typical operation, the public key used for encryption is made public via a readily accessible directory, while the corresponding private key used for decryption is known only to the recipient of the encrypted message. In an exemplary public key transaction, a sender retrieves the recipient's public key and uses it to encrypt the message prior to sending the message. The recipient then decrypts the encrypted message with the corresponding private key. It is also possible to encrypt a message using a private key and decrypt the encrypted message using a public key, which is sometimes used in digital signatures to authenticate the source of a message.
One of the more popular public key algorithms is RSA (named after its inventors--Rivest, Shamir, and Adleman). With RSA, when a message is encrypted utilizing a user public key, the encrypted message may only be decrypted utilizing a user private key. In one implementation, each user private key is also associated with a password, and both are enclosed within an individual secure wrapper. All user private keys along with their respective passwords are stored in a protected storage area within an encryption/decryption device, such as a signature chip. In order to allow the signature chip to perform an authentication procedure, such as signing signatures, a user must provide a correct password to the signature chip. The details of this process can be found in the above-mentioned copending application, the pertinent portion of which is incorporated by reference herein. For security purposes, it is important that no copy of any user private key exists outside the secure wrapper. Thus, a user private key and its respective password can only be unwrapped inside the signature chip, leaving no opportunity for the password to be changed. Nonetheless, for mnemonic reasons such as to allow for a password that is more memorable to a human user (the initial password is generated by a random number generator) and other security reasons such as to protect the private key after the password has been inadvertently disclosed, it is important that the password within the secure wrapper be changed periodically. Consequently, it would be desirable to provide an improved method for associating a password with a secured user public/private key pair.
In accordance with a preferred embodiment of the present invention, a user public/private key pair is first established for a user. The user public/private key pair includes a user public key and a user private key. Then, the user public/private key pair is encrypted along with a random password, utilizing a chip public key. Next, a first password is generated by hashing a first pass phrase. Finally, the random password is encrypted along with the first password, also utilizing the chip public key. As a result, a user can assess the user private key to perform an authentication function by providing the first pass phrase.
If the first password needs to be changed, a second password is generated by hashing a second pass phrase. The random password is then encrypted along with the second password, utilizing the chip public key. At this point, the user can assess the user private key to perform the authentication function by providing the second pass phrase.
All objects, features, and advantages of the present invention will become apparent in the following detailed written description.
The invention itself, as well as a preferred mode of use, further objects, and advantages thereof, will best be understood by reference to the following detailed description of an illustrative embodiment when read in conjunction with the accompanying drawings, wherein:
The present invention may be utilized in a variety of computer systems under a number of different operating systems. The computer systems may be, for example, a personal computer, a mid-range computer, or a mainframe computer. In addition, the computer system may be a stand-alone system or part of a network such as a local-area network (LAN) or a wide-area network (WAN).
Referring now to the drawings and in particular to
Also attached to PCI bus 20 is a communications adapter 15 and a small computer system interface (SCSI) 18. Communications adapter 15 connects computer system 10 to a local-area network (LAN) 17. SCSI 18 is utilized to control a high-speed SCSI disk drive 19. Expansion bus bridge 29, such as a PCI-to-ISA bus bridge, may be utilized for coupling an ISA bus 25 to PCI bus 20. As shown, a keyboard 26 and a mouse 28 may be attached to ISA bus 25 for performing certain basic I/O functions. In addition, an audio adapter 23 and a graphics adapter 21 may be attached to PCI bus 20. Graphics adapter 21 controls visual output through a video monitor 22 and audio adapter 23 controls audio output through a speaker 24.
In addition, a security device, such as a signature chip 31, which contains an encryption/decryption engine 32 and a protected storage area 33, is coupled to PCI bus 20. Encryption/decryption engine 32 includes an encryption/decryption algorithm that is utilized to encode and decode messages transmitted and received by computer system 10. Encryption/decryption engine 32 preferably performs public/private key encryption and decryption. Protected storage area 33 is utilized to store user public/private key pairs. User public/private key pairs stored within protected storage area 33 are protected by encryption/decryption engine 32 and are not directly accessible to computer system 10 or its other components. Protected storage area 33 may be implemented with an electronically erasable storage device.
Each user of computer system 10 has a separate and unique user public/private key pair established for each application within computer system 10. The term "user" is understood to mean a person, a service, an application, a device, or any other entity that may access an application. The term "user" is not limited to a human user. A certificate may be established within computer system 10 for a user to access a particular application. The certificate may be specifically established for and associated with a particular user and a particular application. The certificate preferably includes a pointer to its associated application, an identity of the user associated with this certificate, and a pointer to the user private key associated with the user of this certificate and application. When an application needs to transmit an encrypted message or to perform an authentication procedure, encryption/decryption engine 32 accesses the user private key pointed to by the application's associated certificate, and then encrypts the message or signs a signature utilizing the user private key.
With reference now to
Next, a first password is generated by hashing a first pass phrase, as shown in block 45. A pass phrase is utilized because a pass phrase permits greater permutation, and thus added security, not to mention a pass phrase is easier for a human user to remember than the random password. Utilizing the chip public key, the first password is then encrypted along with the random password, as depicted in block 46. The encrypted package of the first password and random password can then also be stored in the hard disk. At this point, any record of the random password outside the signature chip can also be discarded (by the human user) for security reasons, as illustrated in block 47.
During operation, a first pass phrase sent by a user is hashed by a processor, such as processor 12 in
With reference now to
As has been described, the present invention provides an improved method for associating a password with a secured user public/private key pair. Although the password is preferably encrypted with both user public and private keys (as shown in block 43 of
It is also important to note that although the present invention has been described in the context of a fully functional computer system, those skilled in the art will appreciate that the mechanisms of the present invention are capable of being distributed as a program product in a variety of forms, and that the present invention applies equally regardless of the particular type of signal bearing media utilized to actually carry out the distribution. Examples of signal bearing media include, without limitation, recordable type media such as floppy disks or CD ROMs and transmission type media such as analog or digital communications links.
While the invention has been particularly shown and described with reference to a preferred embodiment, it will be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the invention.
Ward, James Peter, Challener, David Carroll, Dayan, Richard Alan, Vanover, Michael
Patent | Priority | Assignee | Title |
7644278, | Dec 31 2003 | International Business Machines Corporation | Method for securely creating an endorsement certificate in an insecure environment |
7698664, | Sep 26 2003 | Siemens Industry Software Inc | Secure exchange of information in electronic design automation |
7953970, | Mar 10 2001 | International Business Machines Corporation | Method and apparatus for storage of security keys and certificates |
8141142, | Feb 14 2005 | International Business Machines Corporation | Secure authentication of service users of a remote service interface to a storage media |
8171556, | Oct 17 2000 | YAHOO JAPAN CORPORATION | Personal information protection method, personal information protection system, processing device, portable transmitter/receiver, and program |
8284942, | Aug 24 2004 | Microsoft Technology Licensing, LLC | Persisting private/public key pairs in password-encrypted files for transportation to local cryptographic store |
8302039, | Sep 26 2003 | Siemens Industry Software Inc | Secure exchange of information in electronic design automation |
8447990, | Oct 25 2002 | MANGAS GAMING MALTA LIMITED | Password encryption key |
8495361, | Dec 31 2003 | International Business Machines Corporation | Securely creating an endorsement certificate in an insecure environment |
8719952, | Mar 25 2011 | SECSIGN TECHNOLOGIES INC | Systems and methods using passwords for secure storage of private keys on mobile devices |
8739260, | Feb 10 2011 | SECSIGN TECHNOLOGIES INC | Systems and methods for authentication via mobile communication device |
8838975, | Oct 31 2006 | Malikie Innovations Limited | System and method for protecting a password against brute force attacks |
8924742, | Feb 11 2009 | Malikie Innovations Limited | Multi-level data storage |
9292674, | Oct 25 2002 | MANGAS GAMING MALTA LIMITED | Password encryption key |
Patent | Priority | Assignee | Title |
5398285, | Dec 30 1993 | Motorola Mobility LLC | Method for generating a password using public key cryptography |
5511122, | Jun 03 1994 | The United States of America as represented by the Secretary of the Navy; UNITED STATES OF AMERICA, THE, AS REPRESENTED BY THE SECRETARY OF THE NAVY | Intermediate network authentication |
5734718, | Jul 05 1995 | Oracle America, Inc | NIS+ password update protocol |
5768373, | May 06 1996 | Symantec Corporation | Method for providing a secure non-reusable one-time password |
5812669, | Jul 19 1995 | CLASSIFIELD INFORMATION, INC | Method and system for providing secure EDI over an open network |
5812764, | Jan 30 1997 | International Business Machines Corporation | Password management system over a communications network |
5825300, | Nov 08 1993 | ALLEN SYSTEMS GROUP, INC | Method of protected distribution of keying and certificate material |
5953422, | Dec 31 1996 | HEWLETT-PACKARD DEVELOPMENT COMPANY, L P | Secure two-piece user authentication in a computer network |
6061799, | Oct 31 1997 | GOOGLE LLC | Removable media for password based authentication in a distributed system |
6081893, | May 28 1997 | CA, INC | System for supporting secured log-in of multiple users into a plurality of computers using combined presentation of memorized password and transportable passport record |
6111956, | Oct 23 1997 | Signals, Inc.; SIGNALS, INC | Method for secure key distribution over a nonsecure communications network |
6170058, | Dec 23 1997 | CA, INC | Method and apparatus for cryptographically camouflaged cryptographic key storage, certification and use |
6178409, | Jun 17 1996 | Hewlett Packard Enterprise Development LP | System, method and article of manufacture for multiple-entry point virtual point of sale architecture |
6230272, | Oct 14 1997 | ENTRUST, INC ; Entrust Technologies Limited | System and method for protecting a multipurpose data string used for both decrypting data and for authenticating a user |
6253027, | Jun 17 1996 | Hewlett Packard Enterprise Development LP | System, method and article of manufacture for exchanging software and configuration data over a multichannel, extensible, flexible architecture |
6324650, | Nov 02 1998 | Resource Consortium Limited | Message content protection and conditional disclosure |
6567794, | Jun 13 1997 | Pitney Bowes Inc. | Method for access control in a virtual postage metering system |
6594759, | Dec 04 1996 | SERVSTOR TECHNOLOGIES, LLC | Authorization firmware for conducting transactions with an electronic transaction system and methods therefor |
6594763, | Oct 27 1998 | Sprint Communications Company L.P. | Object-based security system |
Executed on | Assignor | Assignee | Conveyance | Frame | Reel | Doc |
Nov 02 1999 | CHALLENER, DAVID C | International Business Machines Corporation | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 010406 | /0862 | |
Nov 02 1999 | DAYAN, RICHARD A | International Business Machines Corporation | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 010406 | /0862 | |
Nov 05 1999 | VANOVER, MICHAEL | International Business Machines Corporation | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 010406 | /0862 | |
Nov 10 1999 | WARD, JAMES P | International Business Machines Corporation | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 010406 | /0862 | |
Nov 12 1999 | International Business Machines Corporation | (assignment on the face of the patent) | / | |||
May 20 2005 | International Business Machines Corporation | LENOVO SINGAPORE PTE LTD | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 016891 | /0507 | |
Apr 01 2013 | LENOVO SINGAPORE PTE LTD | Lenovo PC International | NUNC PRO TUNC ASSIGNMENT SEE DOCUMENT FOR DETAILS | 037160 | /0001 |
Date | Maintenance Fee Events |
May 19 2004 | ASPN: Payor Number Assigned. |
Sep 28 2007 | M1551: Payment of Maintenance Fee, 4th Year, Large Entity. |
Oct 07 2011 | M1552: Payment of Maintenance Fee, 8th Year, Large Entity. |
Oct 07 2011 | M1555: 7.5 yr surcharge - late pmt w/in 6 mo, Large Entity. |
Jun 09 2015 | M1553: Payment of Maintenance Fee, 12th Year, Large Entity. |
Date | Maintenance Schedule |
Apr 06 2007 | 4 years fee payment window open |
Oct 06 2007 | 6 months grace period start (w surcharge) |
Apr 06 2008 | patent expiry (for year 4) |
Apr 06 2010 | 2 years to revive unintentionally abandoned end. (for year 4) |
Apr 06 2011 | 8 years fee payment window open |
Oct 06 2011 | 6 months grace period start (w surcharge) |
Apr 06 2012 | patent expiry (for year 8) |
Apr 06 2014 | 2 years to revive unintentionally abandoned end. (for year 8) |
Apr 06 2015 | 12 years fee payment window open |
Oct 06 2015 | 6 months grace period start (w surcharge) |
Apr 06 2016 | patent expiry (for year 12) |
Apr 06 2018 | 2 years to revive unintentionally abandoned end. (for year 12) |